opensource/iotlink
3
0
Fork 0
mirror of https://gitee.com/sdyunze/iotlink.git synced 2026-08-28 23:50:41 +08:00
Code Issues Packages Projects Releases Wiki Activity

风险修复

Browse Source
This commit is contained in:
山东云则
2025-09-10 10:58:02 +08:00
parent abdfcc54cd
commit 2c4305e635
1 changed files with 26 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
yunze-admin/src/main/java/com/yunze/web/controller/system/SysUserController.java
+26 -8
View File
@@ -206,25 +206,43 @@ public class SysUserController extends BaseController
@PutMapping
public AjaxResult edit(@Validated @RequestBody SysUser user)
{
// 1. 基础权限与数据范围校验
userService.checkUserAllowed(user);
userService.checkUserDataScope(user.getUserId());
deptService.checkDeptDataScope(user.getDeptId());
roleService.checkRoleDataScope(user.getRoleIds());
if (UserConstants.NOT_UNIQUE.equals(userService.checkUserNameUnique(user.getUserName())))
{
return error("修改用户'" + user.getUserName() + "'失败，登录账号已存在");
// 2. 【关键修复 + 优化】用户名唯一性校验：防止普通用户篡改为 admin 等关键用户名
// 优化点：先获取数据库中该用户原始的 userName，仅当新用户名与原用户名不同时才校验唯一性
SysUser existingUser = userService.selectUserById(user.getUserId());
if (existingUser == null) {
return AjaxResult.error("用户不存在");
}
if (!StringUtils.equals(existingUser.getUserName(), user.getUserName())) {
if (UserConstants.NOT_UNIQUE.equals(userService.checkUserNameUnique(user.getUserName()))) {
return AjaxResult.error("修改用户'" + user.getUserName() + "'失败，登录账号已存在");
}
}
// 3. 手机号唯一性校验（仅当值存在且发生变更时）
if (StringUtils.isNotEmpty(user.getPhonenumber())
&& UserConstants.NOT_UNIQUE.equals(userService.checkPhoneUnique(user)))
{
&& !StringUtils.equals(existingUser.getPhonenumber(), user.getPhonenumber())
&& UserConstants.NOT_UNIQUE.equals(userService.checkPhoneUnique(user))) {
return AjaxResult.error("修改用户'" + user.getUserName() + "'失败，手机号码已存在");
}
else if (StringUtils.isNotEmpty(user.getEmail())
&& UserConstants.NOT_UNIQUE.equals(userService.checkEmailUnique(user)))
{
// 4. 邮箱唯一性校验（仅当值存在且发生变更时）
if (StringUtils.isNotEmpty(user.getEmail())
&& !StringUtils.equals(existingUser.getEmail(), user.getEmail())
&& UserConstants.NOT_UNIQUE.equals(userService.checkEmailUnique(user))) {
return AjaxResult.error("修改用户'" + user.getUserName() + "'失败，邮箱账号已存在");
}
// 5. 设置审计字段
user.setUpdateBy(SecurityUtils.getUsername());
// 6. 执行更新
return toAjax(userService.updateUser(user));
}